Data protection by delayed ordered write destage operations

Abstract

Host IO write operations on a given storage group are grouped into cycles of a write destage pipeline for the storage group. Host writes are collected during a capture cycle, while host writes from a previous capture cycle are analyzed and destaged during an apply cycle. After the previous apply cycle has completed, a cycle switch occurs and the current capture cycle becomes the new apply cycle. Anomaly detection is implemented before any IO write operations are destaged during the apply cycle, and if an anomaly is detected the write destage is stopped. The entire apply cycle is either destaged to disk, or is discarded, depending on whether the anomaly is confirmed. By maintaining the order of writes across different cycles, which act as consistency points, it is possible to implement ransomware protection in real time on host write operations, while using ordered write destage to maintain data consistency.